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MONEY TRANSFER EVALUATION 
SYSTEMS AND METHODS 

BACKGROUND OF THE INVENTION 
[01] This invention is related to the field of electronic financial transaction, and in 
particular to electronic value or money transfers. More specifically, the invention is related 
to systems and methods to evaluate such transactions for suspicious activities. 
[02] Electronic transactions play an important role in today's economy. Such transactions 
may include, for example, ACH transactions, credit card transactions, wire transfers, bank 
account transfers, and the like. Such transactions may be performed in a variety of ways, 
including, for example, by using the Internet, by using a phone to contact a service 
representative or an IVR system, by an in-person visit to a financial institution or money 
transfer location, and the like. For example, to perform a money transfer transaction a sender 
may visit a money transfer location and fill out a money transfer application. This 
application may request the sender's name, the name of the recipient and the amount of 
money to be transferred. This information is transmitted to a central database, and the money 
to be transferred is collected from the recipient. When ready to receive the money, the 
recipient may proceed to a pick-up location and provide the proper identification, the 
database is accessed to confirm the recipient and the determine the amount of money to be 
paid to the recipient. After payment, the date and time of payment may also be transmitted to 

the database. 

[03] Unfortunately, it has been reported that some have attempted to abuse such money 
transfer systems including those associated with organized crime, drug dealers, terrorist 
organizations and the like. Various procedures exist to curb such abuses. For example, the 
United States' government has passed laws that encourage reporting of certain suspicious 
monetary transfer activities. See e.g. , 18U.S.C. § 1956-57. However, these laws include 
specific reporting requirements that are well known by criminal elements, and thus easily 
avoided by manipulating money transfer activities to avoid detection. Recent events and the 
increased need for public safety have suggested a need to implement heightened monitoring 
of suspicious activities involving electronic financial transactions. 



1 jfc 



[04] Hence, among other things, this invention is related to ways to monitor and evaluate 
transfers for value and other financial transactions in an attempt to detect potentially 
suspicious activities. 

BRIEF SUMMARY OF THE INVENTION 
[05] The present invention includes a variety of embodiments of both systems and methods 
for evaluating value transfers for suspect activities, such as terrorist activities, money 
laundering, and the like. An embodiment of a system in accordance with the present 
invention includes a money transfer system associated with a fraud processing server. The 
il 0 fraud processing server is capable of accessing money transfer records associated with the 
money transfer system and evaluating the records for any suspect money transfers. 
[06] In some embodiments, the fraud processing server is a fraud processing computer that 
is associated with a computer readable medium. The computer readable medium includes 
computer instructions executable by the fraud processing computer to access a money 
III 5 transfer record; provide a reference designator associated with one or more of a sender 

identification and a receiver identification from a second money transfer record; and compare 
the money transfer record to the reference designator. In some instances, the comparison 
indicates that the money transfer record is not related to the reference designator. In such 
instances, a second reference designator is created and associated with the money transfer 
20 record. 

[07] Various embodiments of methods in accordance with the present invention are also 
provided. One embodiment of a method for evaluating value transfers includes receiving 
money transfer requests, electronically storing records of the money transfer requests, and 
performing an analysis of the records. In some instances, the analysis indicates two or more 
25 of the records are related. A reference designator is created and associated with the related 
records. The reference designator can be used to search various money transfer records 
according to a specified criteria to determine if any of the money transfer requests associated 
with the reference designator are suspect money transfer requests. Suspect money transfer 
requests are flagged. 

30 [08] The method can include identifying a number of different suspicious money transfer 
activities. For example, the method can be used to identify:(a) a transfer from a first sender 
to a second sender followed within a specified period by a transfer from the second sender to 
the first sender; (b) a group of transfers from a sender to a group of receivers, wherein the 
aggregate amount of the group of transfers exceeds a specified level; (c) one or more 
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transfers from a sender to a receiver, wherein the aggregate amount of the one or more 
transfers exceeds a specified level; (d) a group of transfers from a group of senders to a 
receiver, wherein the aggregate amount of the group of transfers exceeds a specified level; (e) 
two transfers from a first sender to a second sender that are followed within a specified period 
5 by corresponding transfers from the second sender to a receiver; (f) two or more transfers 
from a sender to a receiver, wherein the two or more transfers are initiated from two or more 
distinct locations within a region; and/or (g) two or more transfers from a sender to a 
receiver, wherein the two or more transfers are received at two or more distinct locations 
within a region. 



SlO [09] Other embodiments include a method for evaluating electronic value transfers where 

T ft • 

W the method includes accessing a money transfer record, assigning a master location to the 

p money transfer record, and comparing the money transfer record to a reference designator 

mi using a specified criteria. In some instances, one or more fields of the reference designator or 



El [10] Yet other embodiments of the present invention include a method for iteratively 

Wi 

compiling suspect money transfer activities from money transfer records. The method 
includes accessing a first money transfer record; providing a first reference designator; and 
20 comparing the first money transfer record to the first reference designator using a specified 
criteria. In some instances, the comparison indicates the first money transfer record is not 
related to the first reference designator. In such instances, a second reference designator is 
created and associated with the first money transfer record. 

[11] The summary provides only a general outline of the embodiments according to the 
25 present invention. Many other objects, features and advantages of the present invention will 
become more fully apparent from the following detailed description, the appended claims and 
the accompanying drawings. 



[12] A further understanding of the nature and advantages of the present invention may be 
30 realized by reference to the figures which are described in remaining portions of the 

specification. In the figures, like reference numerals are used throughout several figures to 
refer to similar components. In some instances, a sub-label consisting of a lower case letter is 
associated with a reference numeral to denote one of multiple similar components. When 




the money transfer record indicate a relationship between the reference designator and the 
money transfer record. In such instances, the money transfer record and the reference 
designator are associated. 



BRIEF DESCRIPTION OF THE DRAWINGS 
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reference is made to a reference numeral without specification to an existing sub-label, it is 
intended to refer to all such multiple similar components. 

[13] Fig. 1 illustrates a money transfer system capable of evaluation using systems and 
methods in accordance with the present invention; 

[14] Fig. 2 illustrates a fraud watch system associated with the money transfer system of 
Fig. 1 in accordance with an embodiment of the present invention; 
[15] Figs. 3a-3b illustrate an exemplary record of money transfers effectuated using the 
money transfer system of Fig. 1, where Fig. 3a is the first portion of the record and Fig. 3b is 
the second portion of the record; 

[16] Figs. 4a-4b illustrate the record of Fig. 3 that is parsed and stripped in accordance 
with various embodiments of the present invention, where Fig. 4a is the first portion of the 
record and Fig. 4b is the second portion of the record; 

[17] Figs. 5 and 6 illustrate reference designator lists in accordance with embodiments of 
the present invention; 

[18] Figs. 7a-7a illustrate processes associated with monitoring activities on a money 

transfer system in accordance with one embodiment of the present invention; 

[19] Figs. 8a-8m illustrate the reference designator list of Fig. 5 augmented using data 

from the record of Fig. 4 in accordance with methods illustrated in Figs. 7a-7c; 

[20] Figs. 9a-9b illustrate processes associated with monitoring activities on a money 

transfer system in accordance with another embodiment of the present invention; 

[21] Fig. 1 0 illustrates a plurality of fraud watch systems associated with a money transfer 

system in accordance with yet another embodiment of the present invention; and 

[22] Fig. 1 1 illustrates a user interface for selecting an analysis criteria in accordance with 

an embodiment of the present invention. 

DETAILED DESCRIPTION OF THE INVENTION 
[23] This invention relates to methods and systems for evaluating electronic value transfers 
for suspect activities, such as terrorist activities, money laundering, and the like. The 
electronic transfers that may be evaluated may take a variety of forms. For example, such 
electronic transfers may take the form of traditional money transfers where the money to be 
transferred is presented at a first money transfer location and is electronically "wired" to a 
second money transfer location where the transferred money is paid to the recipient. Such 
money transfer services are provided by a number of companies, such as Western Union. 
Other types of electronic transfers may include wire transfers from one financial institution to 
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one or more other financial institutions, electronic ACH transfers, electronic transfers over 
networks, such as the Internet (including those described in copending U.S. Application Nos. 

(Attorney Docket Number 20375-003000US), entitled "Systems and 

Methods of Introducing and Receiving Information Across a Computer Network" and filed 
January 4, 2002, which is incorporated herein by reference for all purposes; 



, entitled "Methods for Receiving Electronically Transferred Funds Using an Automated 
Teller Machine" and filed January 3, 2002, which is incorporated herein by reference for all 

purposes; (Attorney Docket Number 020375-002720US), entitled 

jwi, "Online Funds Transfer Method" and filed on a date prior hereto, which is incorporated 
herein by reference for all purposes. 

[24] Further, although the invention may find its greatest use in relation to cash transfers, 
CI the inven tion may be used to evaluate other types of value transfers as well. For example, the 
invention may be used with value transfers, such as those involving phone minutes, loyalty 
program points and/or awards, frequent flier miles, stored value accounts, and the like. Thus, 
H for purposes of this document, the term money transfer is defined to include any transfer of 
value between entities. Such a money transfer can include a transfer of value between an 
entity and itself, or between an entity and one or more separate entities. For example, a 
money transfer can include a transfer of value between a first person and a second person, 
between a person and a corporation, between a first corporation and a second corporation, 
20 and/ or between a corporation and itself. Such money transfers can include providing value 
and/or information such as, cash, checks, stored value cards, credit cards, debit cards, cash 
cards, a bank account number, a frequent flyer account number, a cellular telephone account 
number, and the like. 

[25] To monitor potentially suspicious activities, some embodiments of the invention 
25 include electronically accessible records relating to money transfers. These records are 

searched according to specified criteria to determine if any transactions are potentially 

suspect. If so, these records are flagged and may be separately stored for further evaluation. 

For example, in the money transfer world, certain dollar value transactions need to be 

reported to the U.S. Government. The historical records may be searched for dollar ranges 
30 just below this limit to determine if multiple transactions are made by the same person or 

received by the same person within a specified time in order to avoid being reported to the 

U.S. Government. 

[26] Various criteria can be defined to evaluate a money transfer system in accordance 
with the present invention including certain transfer amount limits, transactions between 
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particular known entities, transactions associated with messages that are to be translated to 
particular languages, and/or transactions where the value converted to a particular form, such 
as, a particular foreign currency. 

[27] The systems and methods are capable of looking at both sides of a transaction or only 
the sender or receiver side. Other embodiments provide for checking a combination of 
transactions to detect suspicious behavior. Further, embodiments of the present invention 
incorporate a reference designator list useful for, among other things, searching a transaction 
database to identify suspicious and/or illicity transfer activity. In some embodiments, 
elements of the list can be purged based on either time, known information, or a combination 
thereof. 

[28] The systems and methods can be tailored to a particular money transfer system such 
that the overall impact of any monitoring on the transfer system is reduced. Thus, for 
example, such systems and methods can run either in real time or in a batched mode during 
off-peak time for the evaluated money transfer system. In some embodiments, an intelligent, 
iterative approach is applied to identify factors related to suspicious behavior. Such an 
approach can avoid a static situation that, when known to criminal elements, is easily 
avoided. 

[29] The invention provides and/or utilizes various equipment and techniques in relation to 
evaluating money transfers. The invention permits some form of value, such as money, to be 
received and then electronically transferred to another location where it is available for 
pickup or further processing in the same or an alternate form. In some embodiments, a 
money transfer mechanism is utilized to effectuate and/or evaluate a money transfer. Fig. 1 
illustrates an exemplary money transfer system 100. While Fig. 1 illustrates an exemplary 
money transfer mechanism, one of ordinary skill in the art will recognize other money 
transfer mechanisms to which the present invention may be applied or used in conjunction 
with. 

[30] Referring to Fig. 1 , money transfer system 1 00 is comprised of an interface system 
125, an automatic teller system ("ATM") system 145, a deposit maintenance network 150, a 
credit maintenance network 160 and a central exchange 170. Interface system 125 is 
communicably coupled to ATM system 145 via an ATM network 140, deposit maintenance 
network 150 and credit maintenance network 160. In general, interface system 125 unifies a 
variety of transfer systems while supporting a variety of mechanisms for introducing and 
receiving information to and/or from money transfer system 100. 



[31] Interface system 125 comprises a transaction center 130 and one or more terminals 
1 10 in communication via a transaction network 120. Transaction network 120 can be any 

communication network capable of transmitting and receiving information in relation to a 

transfer of value from one entity to another. For example, transaction network 120 can 

5 comprise a TCP/IP compliant virtual private network (VPN), the Internet, a local area 

network (LAN), a wide area network (WAN), a telephone network, a cellular telephone 

network, an optical network, a wireless network, or any other similar communication 

network. In particular embodiments, transaction network 120 provides message based 

^ communications between terminals 110 and transaction center 130. 

|||) [32] Terminals 1 1 0 can be any terminal or location where value is accepted and/or 

4t provided in relation to money transfers across money transfer system 100. Thus, in some 

m instances, terminal 1 10 is a convenience store where a clerk can receive value from a sender 
. 

|*J and initiate transfer of the value to a receiver via money transfer system 100. In such cases, 
n the clerk can typically also provide transferred value to a receiver. 

T ^ I 

|| [33] In other instances, terminal 1 1 0 is an automated system for receiving value from a 
W sender for transfer via money transfer system 100 and/or for providing value to a receiver that 

jp was transferred via money transfer system 100. To accommodate various different payment 

flu 

instruments and types, terminal 1 1 0 can include a variety of interfaces. For example, 
terminal 1 10 can include a mechanism for receiving cash, credit cards, checks, debit cards, 

20 stored value cards and smart cards. Such terminals may also be used at the payout end to 

print a check or money order, or to credit a cash card or stored value card. Examples of such 
terminals are described in copending U.S. Application No. 09/634,901, entitled "POINT OF 
SALE PAYMENT SYSTEM," filed August 9, 2000 by Randy J. Templeton et al., which is a 
nonprovisional of U.S. Prov. Appl. No. 60/147,899, entitled "INTEGRATED POINT OF 

25 SALE DEVICE," filed August 9, 1999 by Randy Templeton et al, the complete disclosures 
of which are herein incorporated by reference. 

[34] In yet other instances, terminal 1 1 0 is a personal computer operated by a sender of 
value. Such a terminal can be communicably coupled to transaction center 130 via the 
Internet. The terminal can further include a web browser capable of receiving commands for 
30 effectuating transfer of value via money transfer system 100. 

[35] Terminal identification information can be associated with each terminal 110. Such 
identification information includes, but is not limited to, a physical location, a telephone 
number, an agent identification number, a terminal identification number, a security alert 
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status, an indication of the type of terminal, a serial number of a CPU, an IP address, the 
name of a clerk, and the like. 

[36] Using money transfer system 1 00, value can be transferred from any of a number of 
points. For example, value can be transferred from terminal 1 10 to itself or any other 
terminal 1 1 0, from any terminal 1 10 to a deposit account via deposit maintenance network 
150 or credit maintenance network 160, from any terminal 1 10 to any ATM 1 14 via ATM 
network 140. Many other transfers to/from ATMs 1 14, deposit accounts, terminals, and/or 
credit accounts can be accomplished using money transfer system 100. 
[37] Referring to Fig. 2, in accordance with some embodiments of the present invention, a 
fraud watch system 210 is provided in communication with transaction center 130 of money 
transfer system 100. As illustrated, transaction center 130 includes a network processor 132 
to process data received and transmitted via transaction network 120. Data to/from network 
processor 132 is available to a host 133 that may communicate with one or more of a value 
translator 135, a transaction database 136, a settlement engine 137 and a messaging engine 
138 to perform functions associated with transferring value via money transfer system 100. 
In turn, messaging engine may communicate with a message translator 139. The received 
and/or provided by transaction center 130 may include information on the sender, 
information on the recipient, identification information associated with a terminal 1 10, the 
type and amount of value transferred, a desired location to transfer the value, and the like. In 
some cases, a value translator 135 may be used to change the type of value. For example, 
value translator 135 may do a foreign currency conversion, or may transfer from one type of 
value to another, e.g. frequent flyer miles to United States' Dollars. All information that is 
processed may conveniently be stored in transaction database 136. 

[38] Settlement engine 137 may be used to facilitate the crediting and debiting of various 

accounts during a transfer. For example, if a sender requests that funds from a credit card 

account be used in the transfer, settlement engine 137 is used to contact credit maintenance 

network 160 to charge the card and to manage the fees involved in the transaction. Such fees 

may be those charged by the credit organization as well as internal fees that are a part of the 

money transfer transaction. Settlement engine 137 may be used in a similar manner when 

crediting or debiting checking accounts, stored value accounts, customer loyalty points and 
the like. 

[39] In some cases, the sender may also wish to send a message with the value. Such a 
message may be a simple greeting, business or legal terms, and the like. Messaging engine 
138 is employed to convert the message to the proper format depending on the type of output 
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device that is to be used with receiving the money. For example, the output device may be a 
printer that physically prints the message onto some type of media. Alternatively, the 
message may be temporarily displayed on a display screen, such as on a kiosk, ATM 
machine, point of sale device, an e-mail, a web page or the like. The sender or recipient may 
also indicate that the message needs to be translated to a different language. In such cases, 
message translator 139 may be used to translate the message into the other language. This 
may be accomplished by simply doing a word look up for each corresponding word in the 
other language. More complex language translation capabilities may also be used. 
[40] Once a value transfer is properly processed, data indicating the transfer is sent by a 
switch 134 to the appropriate network as shown. This may be to ATM network 140, deposit 
maintenance network 150 and/or credit maintenance network 160 to complete the transaction. 
[41] Fraud watch system 210 includes a fraud processing server 220 and a watch database 
230. Fraud watch system 210 is associated with transaction system 130 in a manner that 
allows for access to transaction database 136. Such association can be provided by direct 
wired communication between transaction database 136 and fraud processing server 220, by 
direct or network communication between transaction center 130 and fraud processing server 
220, or by any other mechanism that provides fraud watch system 210 with access to 
transaction database 136. In one particular embodiment, fraud processing server 220 is 
communicably coupled to transaction network 120 and accesses transaction database 136 via 
network processor 132 and host 133. In another embodiment, fraud processing server 220 is 
directly coupled to host 133 and accesses transaction database 136 via host 133. It will be 
recognized by one of ordinary skill in the art that a number of other mechanisms exist within 
the scope of the present invention for providing access by fraud processing server 220 to 
transaction database 136. 

[42] Fraud processing server 220 can be any microprocessor based device capable of 
retrieving data from transaction database 136, searching and manipulating the data, 
maintaining a form of the data on watch database 230, and providing access to data on 
database 230. Such access to the data can include formatting the data and providing the data 
in an easily accessible form. In some embodiments, fraud processing computer is a single 
computer, such as a personal computer or a database server. In other embodiments, fraud 
processing server is a group of two or more computers. In such embodiments, fraud 
processing computer can include a central computer associated with one or more peripheral 
computers. Such peripheral computers can be personal computers or portable devices, such 
as lap top computers and/or personal digital assistants. In a particular embodiment, fraud 



processing server 220 includes a SQL server, while in other embodiments, it includes an 
ORACLE server. 

[43] Fraud processing server 220 includes a computer readable medium capable of 
maintaining instructions executable to perform the functions associated with fraud processing 
server 220. The computer readable medium can be any device or system capable of 
maintaining data in a form accessible to fraud processing computer 220. For example, the 
computer readable medium can be a hard disk drive either integral to fraud processing server 
220 or external to the server. Alternatively, the computer readable medium can be a floppy 
disk or a CD-ROM apart from fraud processing server 220 and accessible by inserting into a 
drive (not shown) of fraud processing server 220. In yet other alternatives, the computer 
readable medium can be a RAM integral to fraud processing server 220 and/or a 
microprocessor (not shown) within the server. One of ordinary skill in the art will recognize 
many other possibilities for implementing the computer readable medium. For example, the 
computer readable medium can be a combination of the aforementioned alternatives, such as, 
a combination of a CD-ROM, a hard disk drive and RAM. 

[44] In some embodiments, transaction database 136 maintains a record of money transfer 
activities associated with money transfer system 100. An exemplary embodiment of such a 
record of money transfer activities 300 is illustrated in Figs. 3a-3b. Referring to Fig. 3a, 
record 300 includes a schema 305 outlining the type of data maintained for each money 
transfer transaction. The types of data can include: a sender's last name, sNameLast 301; a 
sender's middle name, sNameMiddle 303; a sender's first name, sNameFirst 307, a sender's 
phone number, sPhone 309; a sender's address, sAddress 311; the type of agent used by a 
sender, sAgentType 313; the agent's identification number, sAgentNumber 317; the date a 
transfer was requested, sDate 319; the amount of the requested transfer, sAmountln 321; the 
type of value, sValueTypeln 323; the cost of the transfer, sTransactionCost 327; a receiver's 
last name, rNameLast 329; a receiver's middle name, rNameMiddle 331; a receiver's first 
name, rNameFirst 333, a receiver's phone number, rPhone 337; a receiver's address, 
rAddress 339; the type of agent used by the receiver, rAgentType 341; the agent's 
identification number, rAgentNumber 343; the date a transfer was received, rDate 347; the 
amount of the received transfer, rAmountOut 349; and the type of value received, 
rValueTypeOut 351. It should be recognized that, within the scope of the present invention, 
any number of data types can be included in record 300. 

[45] Record 300 further includes a number of specific instances 3 10, 3 1 5, 320, 325, 330, 
335, 340, 345, 350, 355 of schema 305, as illustrated across Figs. 3a and 3b. In this 
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embodiment, the instances are named RECORD 1 through RECORD 10 and each includes 
information associated with an individual money transfer. It should be recognized that 
transaction database 136 can include any number of instances in accordance with the present 
invention. The ten instances chosen and the data associated with each of the individual 
records is to illustrate operation of the present invention as further discussed below. Further, 
it should be understood that within the scope of the present invention, record 300 can be of 
any size and incorporate any data types related to a money transfer system to be evaluated. 
[461 In accordance with some embodiments of the present invention, record 300 is initially 
parsed and stripped of data that is not relevant to evaluation of money transfers occurring on 
gPO money transfer system 100. Some information that is eliminated is easily determined to lack 
relevance, while other information has some relevance, but is stripped from record 300 for 
efficiency reasons. For example, it may be determined that the cost of the money transfer, or 
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fcl sTransactionCost 327, is not relevant to evaluating the various money transfers. In such a 



case, sTransactionCost 327 can be stripped from all of the instances, or individual records 
P$ within record 300. Further, it may be determined that the sender's address, sAddress 3 1 1, is 
© relevant and useful, but not sufficiently useful to warrant utilizing the data in any substantive 
jp analysis. In such cases, sAddress 311 can be stripped from all of the instances within record 
w 300. 

[47] Figs. 4a-4b illustrate a record 400 representing record 300 after it is stripped of 
20 irrelevant and less relevant data types. Referring to Fig. 4a, after the data is eliminated, 

record 400 includes sNameLast 301, sNameFirst 307, sPhone 309, sAgentNumber 317, sDate 
319, rNameLast 329; rNameFirst 333, rPhone 337, rAgentNumber 343. Again, it should be 
recognized that record 400 is merely illustrative and that any data type from record 300 can 
be included or excluded when forming record 400. 
25 [48] As discussed in greater detail below, record 400 is used to construct a reference 

designator list. Exemplary embodiments of such a reference designator list 500 are illustrated 
in Figs. 5, 6 and 8. Referring to Fig. 5, reference designator list 500a includes a single 
reference designator 555 including seven fields associated with the reference designator. 
Reference designator 555 includes a reference designator number 505, name fields 510, 515, 
30 a phone number field 520, master location fields 525, 530, and a time stamp 535. 

[49] In this embodiment, only a single money transfer is indicated. Name fields 510,515 
include the last names 560, 565 and the first names 561, 566 of both the sender and receiver 
involved in the money transfer. Phone number field 520 includes both the phone number of 
the sender and that of the receiver. 
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[50] Time stamp 535 is used to indicate the staleness of information in reference 
designator 555. In some embodiments, time stamp 535 is the most recent sDate 319 from 
record 400 from the various instances clustered into reference designator 555. In other 
embodiments, time stamp 535 is the most recent of either sDate 319 or rDate 347. In 
particular embodiments, reference designators are purged from reference designator list 500 
after a specified period. For example, reference designator 555 can be purged from reference 
designator list 500 if no activity associated with the designator occurs within thirty days, or 
on February 14, 2002 in this instance. Purging reference designator list 500 avoids searching 
based on stale or inactive reference designators. 

[51] MasterLocationln 525 indicates the general area where a the money transfer was 
requested by the sender and MasterLocationOut 530 indicates the general area where the 
money transfer was received by the receiver. In some embodiments, both MasterLocationln 
525 and MasterLocationOut 530 are created using sAgentNumber 317 and rAgentNumber 
343 from record 400. For example, there may be a hundred agents within a particular region, 
all of which are assigned to the same master location number. Thus, where a sender requests 
a money transfer at an agent within the region and subsequently requests a second money 
transfer with another agent in the same region, the same MasterLocationln 525 is assigned to 
both transfers. The assignment of MasterLocationOut 530 is similar, but used in relation to 
where transferred value is received. 

[52] Such an abstraction from the specific location to a master location allows for 
detection of an illegitimate user that hopes to avoid detection by using multiple agent 
locations in a common area. In some embodiments, the master location is the Zip Code of 
the agent location where the agent is in the United States, the first three characters of the 
International Zip Code of the agent location where the agent is in Canada, and the country 
code where the agent is in another country. 

[53] As illustrated in Fig. 6, other embodiments of reference designator list 500 
incorporate different information. Thus, for example, in reference designator list 500b only 
the sender's telephone number 575 is included in phone field 520. This is in contrast to 
reference designator list 500a where both the sender's and receiver's phone numbers were 
included. If it is determined that the receiver's phone number is an unreliable indicator of 
money transfer activity, it can be excluded. For example, in some instances, a large number 
of the receiver's telephone numbers are fictitious, while the sender's telephone number is 
accurate. This often occurs because failure in a money transfer will result in calling the 
sender on the telephone to ask them to return and retrieve their value. In contrast, there is 
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often no reason to telephone the receiver. Thus, an illicit transfer may include an accurate 
sender's telephone number to insure safe return of the transferred value, but provide a 
fictitious receiver's telephone number to avoid detection. Thus, as illustrated in Fig. 6, 
resources are not wasted monitoring the likely fictitious receiver's telephone numbers by not 
placing the telephone numbers in phone field 520. 

[54] As will be further evident from the discussion in relation to Fig. 7 below, reference 
designator 555 represents a cluster of one or more inter-related money transfers. As such, 
fields 510, 515, 520, 525, 530 can include all information related to the particular fields that 
is distilled from a group of inter-related money transfers. The inter-relationship of money 
transfers used to form the basis of a cluster, or reference designator, is determined based on a 
specified criteria. For example, a money cluster may be defined as all transfers that include 
the same phone number in either sPhone 309 or rPhone 337. As will be recognized, the 
specified criteria can include a match or even pseudo-match of any data type from one 
instance in record 400 with any data type from another instance of record 400. Additionally, 
the specified criteria can include a match or pseudo-match of a combination of data types 
from one instance of record 400 with any data type or combination of data types from another 
instance of record 400. Thus, for purposes of this document, a cluster is any association of 
two or more instances, or individual transfer records, based on a specified criteria. 
[55] In some embodiments of the present invention, an analysis of record 300 is 
occasionally performed using all data types within record 300. Such an analysis can be used 
to determine the relevance of data types to any evaluation of money transfer system 100. For 
example, a reference designator list can be developed incorporating all data types from record 
300. Such an approach provides for significant clustering of transactions based on matches 
of various of the data types. When significant clustering is found associated with a particular 
data type, it can be determined if the clustering is indicative of illicit money transfer activity 
and, if so, the data type is identified as a reliable factor and associated with future reference 
designators and search criteria. Thus, some embodiments of the present invention can 
include iterative learning of reliable factors for identifying suspect money transfer requests. 
Such reliable factors can be incorporated into any search routine used to identify suspect 
behavior. 

[56] In some embodiments, fraud processing server 220 maintains reference designator list 
500 on watch database 230, while record 300 is maintained on transaction database 136. This 
separation between fraud watch system 210 and money transfer system 100 provides a level 
of scalability and avoids unnecessary interference with money transfer system 100 by fraud 
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watch system 210. In other embodiments, reference designator list 500 is maintained on 
transaction database 136 and fraud watch system is integrally associated with transaction 
center 130. 

[57] Referring to Figs. 7a-7c, the inter-relationship and operation of fraud watch system 
210 and money transfer system 100 are described. It should be recognized that the inter- 
relationship and operation is merely exemplary and that many other approaches are possible 
within the scope of the present invention. Turning to Fig. 7a, a flow diagram 700 illustrating 
one embodiment of the present invention is described. 

[58] As illustrated, money transfer requests are received by money transfer system 1 00 
(block 705). Such money transfer requests are typically received when a sender enters an 
agent location, or terminal 1 10, and provides value to be transferred. As part of the transfer 
request, the sender provides various information about the transaction including, but not 
limited to, the sender's name, address, and phone number, along with the name, address, and 
phone number of the receiver. The agent associated with terminal 110 then enters the 
sending agent's type, location and identification number, as well as the receiving agent's type 
location and identification number. All of this information is then transmitted from terminal 
1 10 to transaction center 130 via transaction network 120 where it is stored as an individual 
money transfer record on transaction database 136 (block 710). Examples of such money 
transfer records are instances 310, 315, 320, 325, 330, 335, 340, 345, 350, 355 of record 300. 
It should be noted that other methods of requesting a money transfer can be used. For 
example, an ATM 1 14 may be used or any type of terminal 1 10 as previously discussed can 
be used. 

[59] In accordance with the discussion of the operation of money transfer system 100, the 
received and stored money transfer request (blocks 705, 710) is effectuated (block 715). In 
addition, money transfer record 300 is parsed and stripped in preparation for analysis using 
fraud watch system 210 (block 720). As discussed in relation to Fig. 4, such parsing and 
stripping eliminates data from record 300 that is not beneficial to the evaluation of money 
transfer system 100. Thus, for example, record 300 is transformed to record 400. In some 
embodiments, this process is performed once per day when money transfer system 100 is 
experiencing its lightest load. In this way, interference with the performance of money 
transfer system 100 is minimized. In some embodiments, parsing and stripping of record 300 
(block 720) is done each night and only transaction requests received during the preceding 
twenty- four hour period are included in record 300. In other embodiments, parsing and 
stripping of record 300 (block 720) is done each Saturday night and only transaction requests 
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received during the preceding week are included in record 300. In yet other embodiments, 
parsing and stripping of record 300 (block 720) is not performed at all, but rather, record 300 
is provided in its entirety for evaluation. 

[60] Once parsing and stripping (block 720) is complete, parsed and stripped record 400 is 
formatted for transfer (block 725) and transferred to fraud watch system 210 (block 730). 
Transferred record 400 is analyzed by fraud watch system 210 (block 735). Detail of such 
analysis is provided below in relation to Figs. 7b and 7c. 

[61] Referring to Fig. 7b, a flow diagram of block 735 is provided to illustrate an operation 
of fraud processor 210. Fraud processor 210 receives record 400 from money transfer system 
100 (block 701), and accesses the first transaction record, or record 310, therefrom (block 
706). Record 310 is compared to reference designator list 500 to determine if record 310 is 
related to any previously identified money transfer requests or clusters of money transfer 
requests. Various comparison mechanisms are possible in accordance with the present 
invention. 

[62] For example, the comparison can be of sPhone 309 with each entry within phone field 
520 of each reference designator within reference designator list 500. In embodiments where 
reference designator list 500 includes both sender and receiver phone numbers in phone field 
520, the comparison involves checking both the sender and receiver sides of the transaction. 
Alternatively, where reference designator list 500 includes only numbers associated with 
senders within phone field 520, comparison check only one side, the sender's side, of each 
record. In yet another alternative, both sPhone 309 and rPhone 337 are compared to numbers 
maintained within phone field 520 of reference designator list 500. In such embodiments, 
both the sender side and the receiver side of each transaction is evaluated. 
[63] In other embodiments, the sender's and receiver's names are compared to names 
associated with reference designators within name fields 510, 515 of reference designator list 
500. Such comparison can include a comparison of last names followed by first names. In 
particular embodiments, such a name comparison is a phonetic comparison of the names to 
account for both purposeful and accidental mis-spellings of names. It is possible that a 
person intending to make an illicit transfer will provide a phonetically correct, yet technically 
incorrect spelling of their name to avoid detection. In this way, if the transfer fails and they 
are contacted to retrieve the money on the telephone, they will respond properly to the name, 
even though it is incorrectly spelled. In some embodiments, a combination comparison is 
utilized where sNameLast 301 and sNameFirst 307 are compared for an exact match with the 
first and last name fields 510, 515 of a reference designator within reference designator list 
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500. If an exact name match is not found, a phonetic name comparison is performed by 
comparing sNameLast 301 and sNameFirst 307 with entries in name fields 510, 515. 
Alternatively, rNameLast 329 and rNameFirst 333 can be used in various ways for 
comparison and analysis purposes. 

[64] It should be recognized that any number of fields 510, 515, 520, 525, 530, 535 can be 
used either separate or in combination for comparison purposes. This allows for a number of 
different specified criteria for evaluating the various money transfer records. Further, it 
should be recognized that both the sender side of a transaction and the receiver side of the 
transaction can be analyzed, or in other instances, only the sender side or the receiver side of 
|J0 the transaction is analyzed. Furthermore, it should be recognized that different information 
from the sender side as compared with the receiver side may be used. For example, both 
sides of the transaction may be monitored by comparison of sNameLast 301 and sNameFirst 
307 with names in reference designator list 500 using both a phonetic and exact comparison 
method, sPhone 309 with numbers in reference designator list 500, rNameLast 329 and 
rNameFirst 333 using only an exact match criteria, and rAddress 339 with an address field 
jg| (not shown) within reference designator list 500. 

[65] In conjunction with Figs. 8a-8m, Fig. 7c illustrates one particular embodiment of the 
present invention where both sPhone 309 and rPhone 337 are compared with phone field 520, 
sNameLast 301, sNameFirst 307 and rNameLast 329, rNameFirst 333 are compared with 
20 name fields 510, 515, first for exact matches and subsequently for phonetic matches. 

Referring to Fig. 7c, the description proceeds in relation to money transfer record 310 with 
analysis of the record being reflected in an updated reference designator list 500c as 
illustrated in Fig. 8a. 

[66] First, sPhone 309 and rPhone 337 are compared with phone numbers 570, 575 of 
25 reference designator 555 of reference designator list 500a (block 763). As illustrated, neither 
sPhone 309 nor rPhone 337 matches either numbers 570, 575 associated with reference 
designator 555 (block 767). Where no match of phone numbers is found, an exact 
comparison of last names 510 from reference designator 555 is performed with sNameLast 
301 and rNameLast 329 of record 310 (block 771). As illustrated, no match of the last names 
30 exists and thus a comparison of the first names is not required (block 779). Where an exact 
name match does not exist, a phonetic comparison of last names 510 from reference 
designator 555 is performed with sNameLast 301 and rNameLast 329 of record 310 (block 
787). As illustrated, a phonetic match of the last names does not exist and thus a comparison 
of the first names is not required (block 791). Thus, according to the aforementioned 
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embodiment of a search criteria, a relationship does not exist between record 310 and 
reference designator 555. As reference designator list 500a includes only a single reference 
designator 555, the process illustrated as block 71 1 is complete for record 310. However, 
where more reference designators exist, block 71 1 is repeated for each reference designator 
within reference designator list 500. Thus, record 310 would be compared using the 
aforementioned criteria to compare it with each reference designator within reference 
designator list 500. 

[67] Where no relationship is found between record 310 and any of the reference 
designators within reference designator list 500, a new reference designator is created and 
added to the reference designator list (block 731). Referring back to Fig. 7b, record 310 is 
associated with the newly created reference designator (block 736) and a time stamp 535 is 
added to the newly created reference designator (block 741). The newly created reference 
designator is then added to reference designator list 500 (block 746). 
[68] Fig. 8a illustrates updated reference designator list 500c including the newly created 
reference designator, reference designator 810a. Reference designator 810a includes a 
reference designator number 505, sNameLast 301 and rNameLast 337 from record 310 
included in NameLast field 510, sNameFirst 307 and rNameFirst 333 included in NameFirst 
field 515, sPhone 309 and rPhone 337 included in phone field 520, a master location in 
created from sAgentNumber 317 as previously described included in MasterLocationln field 
525, a master location out created from rAgentNumber 343 as previously discussed included 
in MasterLocationOut field 530, and a time stamp defined as sDate 319 included in time 
stamp field 535. 

[69] The indicators (R0) and (Rl) are included for illustration with R0 indicating that the 
included information was part of the initial reference designator list 500a and Rl indicating 
the included information was added to the reference designator list 500a from record 310. 
These designators are for convenience in understanding the following development of 
reference designator list 500 as it is illustrated in Figs. 8a-8m. The following development 
includes use of R0-R10 corresponding to the initial reference designator list 500a and 
information added to the list from records 310, 315, 320, 325, 330, 335, 340, 345, 350. 
[70] Again referring to Fig. 7b, after record 3 1 0 has been analyzed, it is determined if 
additional records (e.g., records 315, 320, 325, 330, 335, 340, 345, 355) remain for analysis. 
As additional records remain for analysis, the next record, record 315, is accessed from 
money transfer record 400 (block 706) and compared with reference designator list as 
illustrated in Fig. 7c (block 71 1). As illustrated by Fig. 8a, sPhone 309 of record 315 
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matches phone number 850 of reference designator 810a (blocks 763, 767). Having found 
this match, record 315 is associated with reference designator 810a (block 721). This 
association is accomplished by adding relevant information from record 315 to reference 
designator 810a. The updated reference designator 810 is illustrated as reference designator 
810b on Fig. 8b. Reference designator 810b includes the sNameLast 301 and sNameFirst 
307 from record 315 added to the name fields 510, 515 of reference designator 810b. As 
shown by the designator (R2) various other elements of record 315 were already represented 
in reference designator 810b. After record 315 is associated with reference designator 810, 
Time stamp 535 of reference designator 810 is updated to be sDate 319 of record 315, where 
sDate 319 is more recent than the previous TimeStamp included with reference designator 
810 (block 726). With analysis of record 315 complete, it is determined if an additional 
record is to be analyzed (block 751). 

[71] As records 320, 325, 330, 335, 340, 345, 350, 355 remain for analysis, the next 
record, record 320, is retrieved from money transfer record 400 (block 706) and compared 
with reference designator list as illustrated in Fig. 7c (block 711). As illustrated by Fig. 8b, 
neither of sPhone 309 or rPhone 337 of record 315 matches any of the phone numbers within 
phone field 520 of either reference designator 555a or reference designator 810b of reference 
designator list 500d (blocks 763, 767). Further, neither sNameFirst 307 and sNameLast 301 
nor rNameFirst 333 and rNameLast 329 matches any of the names within name fields 510, 
515 of either reference designator 555a or reference designator 810b (blocks 771, 779). Yet 
further, a phonetic match of the names does not exist (blocks 787,791). As no matches are 
identified, it is determined that record 320 is not related to any of the reference designators 
within reference designator list 500. Thus, a new reference designator is created (block 731) 
and record 320 is associated with the newly created reference designator (block 736). The 
newly created reference designator is then added to reference designator list 500 (block 746). 
[72] Fig. 8c illustrates updated reference designator list 500 including the newly created 
reference designator, reference designator 820. Reference designator 820 includes a 
reference designator number 505, sNameLast 301 and rNameLast 337 from record 320 
included in NameLast field 510, sNameFirst 307 and rNameFirst 333 included in NameFirst 
field 515, sPhone 309 and rPhone 337 included in phone field 520, a master location in 
created from sAgentNumber 317 as previously described included in MasterLocationln field 
525, a master location out created from rAgentNumber 343 as previously discussed included 
in MasterLocationOut field 530, and a time stamp defined as sDate 319 included in 
TimeStamp field 535, 



18 



[73] After record 320 has been analyzed it is determined if additional records (e.g., records 
325, 330, 335, 340, 345, 355) remain for analysis. As additional records remain for analysis, 
the next record, record 325, is accessed from money transfer record 400 (block 706) and 
compared with reference designator list as illustrated in Fig. 7c (block 711). As illustrated by 
Fig. 8c, sPhone 309 of record 325 matches a phone number of reference designator 810b 
(blocks 763, 767). Having found this match, record 325 is associated with reference 
designator 810b (block 721). This association is accomplished by adding relevant 
information from record 325 to reference designator 810b. The updated reference designator 
810 is illustrated as reference designator 810c on Fig. 8d. Reference designator 810b 
includes the sNameLast 301 and sNameFirst 307 from record 325 added to the name fields 
510, 515 of reference designator 810c. Further, because sAgentNumber 317 and 
rAgentNumber 343 indicate sending and receiving areas different from those already 
recorded in MasterLocationLa 525 and MasterLocationOut 530, the new locations are added 
to the respective fields. After record 325 is associated with reference designator 810, Time 
stamp 535 of reference designator 810 is updated to be sDate 319 of record 325, where sDate 
3 1 9 is more recent than the previous TimeStamp included with reference designator 810 
(block 726). Thus, Time stamp 535 of reference designator 810 changes from 01/18/2002 to 
01/19/2002. With analysis of record 325 complete, it is determined if an additional record is 
to be analyzed (block 751). 

[74] As records 330, 335, 340, 345, 350, 355 remain for analysis, the next record, record 
330, is retrieved from money transfer record 400 (block 706) and compared with reference 
designator list as illustrated in Fig. 7c (block 711). As illustrated by Fig. 8d, neither of 
sPhone 309 or rPhone 337 of record 330 matches any of the phone numbers within phone 
field 520 of either reference designator 555a, reference designator 810c, or reference 
designator 820 of reference designator list 500e (blocks 763, 767). Further, neither 
sNameFirst 307 and sNameLast 301 nor rNameFirst 333 and rNameLast 329 matches any of 
the names within name fields 510, 515 of any of the reference designators (blocks 771, 779). 
However, a phonetic match of the sNameLast 301 with last name 855 within NameLast field 
510 exists (blocks 787, 791). Having found a phonetic match of last names, a phonetic 
comparison of first names is then performed (block 787). As sNameFirst 307 from record 
330 is a phonetic match with name 856 within NameLast field 515, a complete phonetic 
match is indicated (block 791) and record 330 is associated with reference designator 810 
(block 721). 
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[75] This association is accomplished by adding relevant information from record 330 to 
reference designator 810c. The updated reference designator 810 is illustrated as reference 
designator 810d on Fig. 8e. Reference designator 810d includes the added spelling of 
sNameLast 301 from 330 added to name field 510 and rNameLast 329 and rNameFirst 333 
added to name fields 510, 515 of reference designator 810d. In addition, sPhone 309 and 
rPhone 337 are added to phone field 520. Further, because sAgentNumber 317 and 
rAgentNumber 343 indicate sending and receiving areas different from those already 
recorded in MasterLocationln 525 and MasterLocationOut 530, the new locations are added 
to the respective fields. After record 330 is associated with reference designator 810, Time 
stamp 535 of reference designator 810 is updated (block 726). However, because sDate 319 
is the same as the previous Time stamp 535, the update is not completed. With analysis of 
record 330 complete, it is determined if an additional record is to be analyzed (block 751). 
[76] As records 335, 340, 345, 350, 355 remain for analysis, the next record, record 335, is 
retrieved from money transfer record 400 (block 706) and compared with reference 
designator list as illustrated in Fig. 7c (block 711). As illustrated by Fig. 8e, neither of 
sPhone 309 or rPhone 337 of record 335 matches any of the phone numbers within phone 
field 520 of any of the reference designators of reference designator list 500g (blocks 763, 
767). However, sNameFirst 307 and sNameLast 301 matches a name within name fields 
510, 515 of reference designator 810d (blocks 771, 779). Thus, a relationship between record 
335 and reference designator 810d is indicated. Based on this indication, record 335 is 
associated with reference designator 810 (block 721). 

[77] This association is accomplished by adding relevant information from record 335 to 
reference designator 810d. The updated reference designator 810 is illustrated as reference 
designator 810e on Fig. 8f. Reference designator 810e includes added rNameLast 329 and 
rNameFirst 333 in name fields 510, 515 of reference designator 810e. In addition, sPhone 
309 and rPhone 337 are added to phone field 520. Further, because sAgentNumber 317 and 
rAgentNumber 343 indicate sending and receiving areas different from those already 
recorded in MasterLocationln 525 and MasterLocationOut 530, the new locations are added 
to the respective fields. After record 335 is associated with reference designator 810, Time 
stamp 535 of reference designator 810 is updated (block 726). However, because sDate 319 
is actually earlier than the previous Time stamp 535, the update is not completed. With 
analysis of record 335 complete, it is determined if an additional record is to be analyzed 
(block 751). 
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[78] As records 340, 345, 350, 355 remain for analysis, the next record, record 340, is 
retrieved from money transfer record 400 (block 706) and compared with reference 
designator list as illustrated in Fig. 7c (block 711). As illustrated by Fig. 8f, sPhone 309 of 
record 335 matches a phone number within phone field 520 of reference designator 81 Of of 
reference designator list 500h (blocks 763, 767). Based on this indication, record 340 is 
associated with reference designator 810 (block 721). 

[79] This association is accomplished by adding relevant information from record 340 to 
reference designator 810e. The updated reference designator 810 is illustrated as reference 
designator 810f on Fig. 8g. Reference designator 810f includes added sNameFirst 307 in 
name field 515 and added rPhone 337 in phone field 520 of reference designator 81 Of. Time 
stamp 535 is not updated as sDate 319 is not more recent than the previous time stamp (block 
726). With analysis of record 340 complete, it is determined if an additional record is to be 
analyzed (block 751). 

[80] As records 345, 350, 355 remain for analysis, the next record, record 345, is retrieved 
from money transfer record 400 (block 706) and compared with reference designator list 500 
as illustrated in Fig. 7c (block 71 1). As illustrated by Fig. 8g, neither of sPhone 309 nor 
rPhone 337 of record 345 matches any of the phone numbers within phone field 520 of any 
reference designaotrs of reference designator list 500k (blocks 763, 767). Further, neither 
sNameFirst 307 and sNameLast 301 nor rNameFirst 333 and rNameLast 329 matches any of 
the names within name fields 510, 515 of either reference designator 555a, reference 
designator 81 Of, or reference designator 820 (blocks 771, 779). However, an exact match of 
sNameLast 301 with last name 860 within NameLast field 510 exists (blocks 771, 779). 
Having found an exact match of last names, a phonetic comparison of first names is then 
performed (block 787). As sNameFirst 307 from record 345 is a phonetic match with name 
861 within NameFirst field 515, a complete phonetic match is indicated (block 791) and 
record 345 is associated with reference designator 555 (block 721). 

[81] This association is accomplished by adding relevant information from record 345 to 
reference designator 555a. The updated reference designator 555 is illustrated as reference 
designator 555b on Fig. 8h. Reference designator 555b includes added sNameFirst 307 in 
name field 515 and added sPhone 309 and rPhone 337 in phone field 520 of reference 
designator 555b. Time stamp 535 is not updated as sDate 3 19 is not more recent than the 
previous time stamp (block 726). With analysis of record 345 complete, it is determined if an 
additional record is to be analyzed (block 751). 



21 



[82] As records 350, 355 remain for analysis, the next record, record 350, is retrieved from 
money transfer record 400 (block 706) and compared with reference designator list 500 as 
illustrated in Fig. 7c (block 711). As illustrated by Fig. 8h, rPhone 337 of record 350 
matches a phone number within phone field 520 of designator 555b (blocks 763,767). Based 
5 on this indication, it is determined that record 350 is related to reference designator 555b, 
thus, record 350 is associated with record designator 555b (block 321). 
[83] This association is accomplished by adding relevant information from record 350 to 
reference designator 555b. The updated reference designator 555 is illustrated as reference 
designator 555c on Fig. 8k. Reference designator 555c includes added sPhone 309 in phone 
1*U0 field 520 of reference designator 555c. Further, a new master location in is added in 
*? I MasterLocationln field 525 based on the new sAgentNumber 317. Time stamp 535 is 
5J* updated to sDate 319 because sDate is more recent than the previous time stamp (block 726). 
|p With analysis of record 350 complete, it is determined if an additional record is to be 
f ~ analyzed (block 75 1). 

f 5 [84] As record 355 remains for analysis, it is retrieved from money transfer record 400 
jp. (block 706) and compared with reference designator list 500 as illustrated in Fig. 7c (block 
m% 711). As illustrated by Fig. 8k, sPhone 309 of record 355 matches a phone number within 
W phone field 520 of designator 81 Of (blocks 763,767). Based on this indication, it is 

determined that record 355 is related to reference designator 810f, thus, record 355 is 
20 associated with record designator 810f (block 721). 

[85] This association is accomplished by adding relevant information from record 355 to 
reference designator 81 Of. The updated reference designator 810 is illustrated as reference 
designator 810g on Fig. 8m. Reference designator 810g includes sNameLast 301 and 
sNameFirst 307 in name fields 510, 515 of reference designator 810g. Further, rPhone 337 is 
25 added to phone field 520. Time stamp 535 is not updated as sDate 3 1 9 is not more recent 
than the existing time stamp With analysis of record 355 complete, it is determined if an 
additional record is to be analyzed (block 751). 

[86] As no other records remain for analysis, reference designator list 500 is analyzed to 
identify reference designators that are associated with suspect money transfer activity (block 
30 756). For example, reference designator 820 may be eliminated from consideration because 
it represents only a single transfer. Furthermore, as provided by sAmountln 321 of record 
300, sub-record 320, reference designator 820 is associated with a total transfer of only seven 
hundred, sixty-five Dollars. This is likely to be less than a suspect amount. However, if the 
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single transfer associated with reference designator 820 was more than, for example, five 
thousand Dollars, reference designator 820 could still indicate a suspect transfer. 
[87] In contrast to reference designator 820, reference designator 810 represents a cluster 
of seven related transactions (e.g. records 310, 315, 325, 330, 335, 340, 355). Such a large 
cluster of related transactions within a limited time period may be considered suspect. In 
some embodiments, such a reference designator would be presumptively placed on a high 
priority consideration list. 

[88] Reference designator 555 shows a relationship between three records, records 345, 
350 and a prior record (designated (R0)). Minimal inter-relationships as exhibited here may 
or may not be indicative of suspect activity. 

[89] In some embodiments of the present invention, various reference designators from 
reference designator list 500 are maintained on fraud watch system 210, but not transferred 
back to money transfer system 100 because they do not warrant further investigation or 
analysis. For example, reference designators 555, 810 may be transferred back to transaction 
center 130 for additional analysis, while reference designator 820 is not (block 761). In other 
embodiments, all reference designators are provided to transaction center 130 for additional 
analysis (block 761). 

[90] Returning to Fig. 7a, reference designator list 500 is provided by fraud watch system 
210 to money transfer system 100 (block 740). Reference designator list 500 is used in 
relation with database management tools to access various money transfer records within 
transaction database 136 that, based on the reference designators, appear to be suspect (block 
745). Using the database management tools and reference designators 555, 810, 820, various 
indicators associated with a particular reference designator can be investigated. For example, 
in some embodiments, a reference designator is used to search through transaction database 
136 and aggregate the amounts of value transferred across all transactions clustered in 
association with a particular reference designator. Thus, using reference designator 810 for 
illustration, it can be determined that the seven transactions associated with reference 
designator 810 involve a total of twenty thousand, five hundred, ninety-six Dollars over a two 
day period (aggregate all sAmountln 321 for the seven transactions). In some cases, this is 
considered highly suspect warranting additional investigation and/or reporting to the 
authorities. This process of aggregating transfer amounts can be fine tuned to select a single 
day transfer amount or a multi-day transfer amount. Furthermore, this process of aggregating 
can be tuned to select a single day amount in from just senders or amount out provided to 
receivers. Alternatively, multi-day amounts can be determined for just senders or receivers. 
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[91] It should be recognized that any number of analysis may be performed in accordance 
with the present invention using reference designator list 500. Indeed, one of ordinary skill in 
the art will recognize a myriad of transaction types that can be analyzed based on reference 
designator list 500. For example, multiple transactions from agent to agent may be provided. 
Further, all transactions involving a single sender and a single receiver, a single sender and 
multiple receivers, or multiple senders and a single receiver can be determined. Additionally, 
a list of known suspect users can be developed by analyzing transaction database 136 using 
reference designator list 500. Such known suspect users can be designated by name, phone 
number, address, identification number, agent number, or the like. 
[92] The myriad of different reports discussed above can be accessed by selecting a 
particular report type and printing the associated report (block 750). In some embodiments, 
software including a variety of user interfaces is provide to allow for easy selection and 
access to a variety of report types. The software utilizes reference designator 500 to parse 
through transaction database 136 and generate the desired report. An example of such a user 
interface is illustrated in Fig. 11. 

[93] Referring to Fig. 1 1, a user interface 1 100 includes selection categories 1 190 
providing a mechanism for selecting a variety of reports. More particularly, selection 
categories 1 190 include a selection for generating a report aggregating the total amount in by 
a single sender in a single day 1 105, a selection for generating a report aggregating the total 
amount in by a single sender in a multi-day period 1 1 10, a selection for generating a report 
aggregating the total amount out to a receiver in a single day 1 1 15, a selection for generating 
a report aggregating the total amount out to a receiver in a multi-day period 1 120, a selection 
for generating a report aggregating the total amount of transactions between two agents 1 125, 
a selection for generating a report aggregating the total amount between a single user and a 
single receiver 1 135, a selection for generating a report aggregating the total amount out 
between a single sender and multiple receivers 1 140, and a selection for generating a report 
aggregating the total amount transferred between multiple senders and a single receiver 1145. 
[94] In addition, selection categories 1 190 includes selections for generating a report of 
known good names 1 150 and known bad names 1 155. Also, selections for generating a 
report of known good phone numbers 1 160 and known bad phone numbers 1 165 are 
provided. Known good names and numbers can be identify when a reference designator is 
investigated and, for example, it is determined that the reference designator indicates 
legitimate commercial activity. Thus, for example, reference designator 555 includes a 
number of transactions to "Sales Corporation" as indicated by rNameFirst 333 and 
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rNameLast 329 from records 345, 350. This type of activity is commonly clustered and can 
result in a reference designator associated with a large number of transactions. To avoid 
continuous investigation of known legitimate senders and receivers, their names can be so 
identified. Further investigation can be eliminated altogether, or in some cases, only 
periodically reviewed to consider any change in activity warranting removal from listing as 
known good users. Similarly, where illegitimate activity is detected, users can be identified 
as known bad users and investigative activities increased in relation to the known bad user. 
[95] At this juncture, it should be recognized that processes discussed in relation to Figs. 
7a-7c can be accomplished by transaction center 130 apart from fraud watch system 210 or 
fH) by fraud watch system 210 apart from transaction center 130. Alternatively, the processes 

can be accomplished by any combination of fraud processing center 210 with transaction 
Jw* center 130. Thus, the indications of which processor is performing a certain task merely 

|! t 

m indicate a single embodiment. One of ordinary skill in the art will recognize a number of 
W" possibilities within the scope of the present invention for distributing the various processes 

ii 

If discussed in relation to Figs. 7a-7c between transaction center 130 and fraud watch system 
210. 

[96] Figs. 9a-9b illustrates a flow diagram 900 of another embodiment of the present 



Sis ft 



p 

ff J invention where activities of money transfer system 100 are evaluated in real time. Money 
transfer requests are received by money transfer system 100 (block 905). The received 

20 money transfer requests are stored to transaction database 136 (block 910). The stored 
money transfer request is parsed and stripped of any data that is not relevant to evaluating 
money transfer system 100 (block 915) and the parsed and stripped record of the money 
transfer request is provided to fraud watch system 210 (block 920). The individual money 
transfer request is then analyzed in real time by fraud watch system 210 (block 925). 

25 [97] Referring to Fig. 9b, block 925 is described in detail. The record of the individual 

money transfer request is received by fraud watch system 210 (block 955) and compared with 
an existing reference designator list (block 957). It is determined if the record matches any of 
the reference designators within the reference designator list (block 959). 
[98] If the record does not match any reference designator list, a new reference designator 

30 is created (block 969) and data from the record under evaluation is associated with the newly 
created reference designator (block 971). A time stamp is added to the newly created 
reference designator (block 973) and the reference designator is added to the reference 
designator list (block 975). Finally, a transaction that does not match any of the reference 
designators in the reference designator list is presumptively a legitimate transaction and, thus, 
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is identified as a good transaction to money transfer system 100 (block 977). The good 
indicator is received by money transfer system 100 (block 930), identified as a good indicator 
(block 935), and the requested transaction is allowed to proceed forward (block 940), 
[99] If, on the other hand, the record does match a reference designator on the reference 
designator list (block 959), the record is associated with the matched reference designator 
(block 961). The matched reference designator is then analyzed to determine if the reference 
designator is known to be associated with illegitimate activity, and if so, whether the recently 
received record is indicative of the known illegitimate activity (block 963). If either the 
matched reference designator is not associated with known illegitimate activity, or the new 
record is not identified with known illegitimate activity, no problem is indicated (block 965). 
In such a situation, a good indicator is provided to money transfer system 100 (block 977) 
and the transaction is allowed to continue (block 940). 

[100] Alternatively, if the matched reference designator is associated with known 
illegitimate activity and the new record is identified with that activity, a problem is indicated 
(block 965). Once a problem is indicated (block 965), a bad indicator is provided to money 
transfer system 100 (block 967). The bad indicator is received by money transfer system 100 
(block 930), identified as a bad indicator (block 935), and the requested transaction is denied 
(block 945). Further, in some embodiments, the authorities are immediately alerted (block 
950). 

[101] Referring to Fig. 10, an embodiment incorporating multiple fraud watch systems 210 
with multiple transaction centers 130 in a compound money transfer system 1000 is 
illustrated in accordance with an embodiment of the present invention. In such a system, 
fraud watch system 210a can watch for illegitimate behavior localized to transaction center 
130a. Similarly, fraud watch system 210b can watch for illegitimate behavior localized to 
transaction center 130c. This allows for some activity to be identified at a local level. What 
activity is not identified at a local level is detected at a higher level by fraud watch system 
210c associated with transaction center 130d. It should be recognized that any combination 
of transaction centers 130 and fraud watch systems 210 can be combined to provide an 
efficient and accurate evaluation of money transfer system 1000. 
[102] The invention has now been described in detail for purposes of clarity and 
understanding. However, it will be appreciated that certain changes and modifications may 
be practiced within the scope of the appended claims. For example, other criteria may be 
used for identifying relationships between reference designators and money transfer records. 
Additionally, other criteria may be used for analyzing a money transfer database using the 
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reference designators. Thus, although the invention is described with reference to specific 
embodiments and figures thereof, the embodiments and figures are merely illustrative, and 
not limiting of the invention. Rather, the scope of the invention is to be determined solely by 
the appended claims. 
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